1
00:00:00,830 --> 00:00:03,800
Now let's talk about clearing tracks.

2
00:00:04,430 --> 00:00:08,090
So removing evidences is very important part.

3
00:00:08,270 --> 00:00:08,930
Right.

4
00:00:09,620 --> 00:00:16,040
Because if you leave your footprints there, then it is easy for security experts to track you.

5
00:00:16,850 --> 00:00:22,730
So hackers mainly focus on clearing evidences or clearing footprints.

6
00:00:24,440 --> 00:00:27,470
So we will see how we can do it.

7
00:00:27,500 --> 00:00:35,360
First of all, it is very important to know that whenever you do any activity in your operating system,

8
00:00:35,360 --> 00:00:40,820
let's say you log into the system or you log out from there or you do anything.

9
00:00:41,000 --> 00:00:49,220
Your system creates some events, some logs, and they are stored under different locations.

10
00:00:50,090 --> 00:00:54,140
It depends on the type of log, right?

11
00:00:54,170 --> 00:00:58,160
So there are security logs, there are application logs, etc..

12
00:00:58,160 --> 00:01:03,440
So we will see how we can find them and clear them.

13
00:01:04,130 --> 00:01:13,330
So first of all, let's open the command prompt and we will use a command called audit pole.

14
00:01:15,350 --> 00:01:23,180
Audit will stands for audit policy and if I hit enter, we will see different options available here

15
00:01:23,180 --> 00:01:24,950
to be used with this command.

16
00:01:26,060 --> 00:01:37,990
So let's see audit poll, a slash gate slash category start.

17
00:01:38,030 --> 00:01:40,310
Start times for all.

18
00:01:40,310 --> 00:01:41,600
Select all.

19
00:01:43,200 --> 00:01:43,860
See.

20
00:01:44,610 --> 00:01:48,420
Here are a list of different logs.

21
00:01:48,600 --> 00:01:49,500
So.

22
00:01:50,790 --> 00:01:55,170
And these are divided under types and subtypes.

23
00:01:56,310 --> 00:01:56,820
Right.

24
00:01:57,600 --> 00:02:01,530
You can scroll and see all of them here.

25
00:02:04,470 --> 00:02:11,470
Now, we can also use audit pole in order to clear all of these logs.

26
00:02:11,490 --> 00:02:20,460
And for this simply type slash and clear hit enter.

27
00:02:21,210 --> 00:02:26,430
It says, are you sure press kn to cancel or any other key to continue.

28
00:02:27,720 --> 00:02:29,910
So let's do that.

29
00:02:31,890 --> 00:02:34,500
It says the command was successfully executed.

30
00:02:34,530 --> 00:02:37,890
Now let's check it again and see.

31
00:02:38,430 --> 00:02:40,560
It says no logs remaining.

32
00:02:40,570 --> 00:02:41,490
Och, no auditing.

33
00:02:41,490 --> 00:02:42,990
No auditing, no auditing.

34
00:02:44,340 --> 00:02:51,180
So this way you can detect different kinds of logs and you can clear them as well.

35
00:02:51,210 --> 00:02:51,840
Right.

36
00:02:51,930 --> 00:02:56,790
So audit poll is the one way as it uses command prompt.

37
00:02:56,820 --> 00:03:01,780
Now let's see one other thing, which is called as event viewer.

38
00:03:01,800 --> 00:03:02,400
Right.

39
00:03:02,610 --> 00:03:10,380
So within the Windows operating system, the event viewer is an application that presents all application

40
00:03:10,380 --> 00:03:15,200
security setup and system logs within a single dashboard.

41
00:03:15,210 --> 00:03:15,780
Right.

42
00:03:16,320 --> 00:03:30,630
So to access event, we were simply hit window key, which are so window R and type event v w r dot

43
00:03:30,660 --> 00:03:32,910
msi and hit enter.

44
00:03:36,330 --> 00:03:38,610
And let's wait for it to open.

45
00:03:38,730 --> 00:03:42,990
Now go to window logs.

46
00:03:43,800 --> 00:03:44,340
Right.

47
00:03:44,940 --> 00:03:49,260
See, now you have all types of logs here.

48
00:03:50,520 --> 00:03:54,330
And it has also mentioned a number of events it recorded.

49
00:03:54,990 --> 00:03:57,480
And these are divided into different categories.

50
00:03:57,480 --> 00:03:59,890
Like the first one is for application logs.

51
00:03:59,910 --> 00:04:01,620
Second one is for security.

52
00:04:01,650 --> 00:04:04,800
Third is set up, then system and then forwarded events.

53
00:04:05,670 --> 00:04:15,120
So to clear these simply right click on this here, simply right click and select clear log.

54
00:04:17,100 --> 00:04:22,860
So these two are the easiest way to detect logs and clear them.

55
00:04:23,130 --> 00:04:23,730
Right.

56
00:04:23,880 --> 00:04:31,500
So in this lesson, we have learned how we can use audit pole and event viewer in order to access different

57
00:04:31,500 --> 00:04:34,350
kind of logs and to remove them.